CVE-2026-64193

NameCVE-2026-64193
DescriptionNet::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1142503

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libnet-dns-perl (PTS)bullseye1.29-1vulnerable
bookworm1.36-1vulnerable
trixie1.50-1vulnerable
forky1.55-1vulnerable
sid1.56-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libnet-dns-perlsource(unstable)1.56-11142503

Notes

https://lists.security.metacpan.org/cve-announce/msg/41989543/
https://rt.cpan.org/Ticket/Display.html?id=179945

Search for package or bug name: Reporting problems